This in-equality check will always be satisfied.
As the storedPassword can never be equal to the password provided in the request(assuming we never provide the password to the frontend....), as this is either a new one (in plain text, not hashed) or undefined.

To fix this, check if there is a password provided, not undefined and not empty string + (@spiftire is creating validation). Then just hash that password and update, it is not possible to perform an equality as a new hash would always be different, even with the same input :D